Detection rules › By catalog entry

M365-ExchangeItemGroup

Catalog entry	Rules
HardDelete	6
MoveToDeletedItems	1
SoftDelete	3

HardDelete

6 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

M365 Exchange MFA Notification Email Deleted or Moved severity low T1070,T1070.008,T1098,T1098.005

Splunk (5)

MoveToDeletedItems

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

M365 Exchange MFA Notification Email Deleted or Moved severity low T1070,T1070.008,T1098,T1098.005

SoftDelete

3 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

M365 Exchange MFA Notification Email Deleted or Moved severity low T1070,T1070.008,T1098,T1098.005

Splunk (2)

O365 Email Password and Payroll Compromise Behavior severity medium T1070,T1070.008,T1114,T1114.001,T1485
O365 Email Send and Hard Delete Suspicious Behavior severity low T1070,T1070.008,T1114,T1114.001,T1485

Back to all M365-ExchangeItemGroup catalog entries